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Sir: 



Applicant reinstates the previously-filed Notice of Appeal (June 28, 2007) and submits 
this Supplemental Appeal Brief in response to the Notice of Non-Compliant Appeal Brief mailed 
on September 6, 2007. 

This Supplemental Appeal Brief is submitted in support of the Appeal of the Examiner's 
rejection of Claims 1-6, 8-10, 13-23 and 25 in the above-identified application as set forth in the 
non-final Office Action dated March 14, 2007. A Notice of Appeal was electronically filed in 
this case on June 28, 2007 and received in the United States Patent and Trademark Office on 
June 28, 2007. 

Prosecution was re-opened by the Examiner in view of the Reversal/Remand Decision by 
the Board of Appeals dated September 27, 2006. 
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REAL PARTY IN INTEREST 



The Real Party in Interest in the present Appeal is International Business Machines 
Corporation, the assignee, as evidenced by the assignment set forth at Reel 010477, Frame 0042. 

RELATED APPEALS AND INTERFERENCES 

Notice of Appeal for the instant application (U.S. Ser. No. 09/466,438) was first filed on 
August 28, 2003. The Board of Patent Appeals and Interferences ("Board") issued its Decision 
on Appeal ("Decision") on September 27, 2006, reversing/remanding the case to the Examiner 
for further consideration of a rejection pursuant to 37 C.F.R § 41.50(a)(1) (effective September 
13, 2004, 69 Fed. Reg. 49960 (August 12, 2004), 1286 Off. Gaz. Pat. Office 21 (September 7, 
2004)). The Examiner re-opened prosecution and issued a non-final Office Action on March 14, 
2007 ("present Office Action"), from which the instant Appeal is initiated. 

STATUS OF THE CLAIMS 

Claims 1-25 were originally presented. Claims 7, 11-12 and 24 are cancelled. Claims 1- 
6, 8-10, 13-23 and 25 stand non-fmally rejected by the Examiner following Appeal, as noted in 
the Present Office Action, and remain on Appeal. 

STATUS OF THE AMENDMENTS 

No amendment was submitted subsequent to the Present Office Action. 

SUMMARY OF THE CLAIMED SUBJECT MATTER 

As shown in Figures 1-4, Appellant's invention comprises a method, system, and 
computer program product for prompting a repeat user of a payment card at an interface terminal 
with additional security-related questions when the user selects responses that deviate from his or 
her typical selections. 



U.S. Application No. 09/466,438 



Appeal Brief - Page 2 



Attorney Docket No. AT9-99-725 



Independent Claim 1 recites a method for automatically authorizing a remote point of 
purchase action at a facility which permits such actions. The method comprises the steps of 
storing selections of goods and/or services made by an authorized user during a previous 
transaction (Fig. 4, step 409; p. 9, lines 30-34; p. 10, lines 6-15); prompting a user with options 
for selecting goods and/or services during a current transaction at the facility (Fig. 4, step 41 1; p. 
10, lines 1-6); comparing the options for goods and/or services selected by the user with the 
user's prestored selections of goods and/or services (Fig. 4, step 413; p. 10, lines 17-22); 
requiring the user to answer a security-related question if the options for goods and/or services 
selected by the user are inconsistent with the user's prestored selections of goods and/or services 
(Fig. 4, step 417; p. 10, line 28 to p. 11, line 8); and thereafter permitting the current transaction 
only if the user correctly answers said security-related question (Fig. 4, step 415; p. 11, lines 15- 
19). 

Independent Claim 9 recites a method for automatically authorizing a remote point of 
purchase action with a credit or debit card at facilities which permit such actions. The method 
comprises the steps of storing selections of goods and/or services made by an authorized user 
during the previous n transactions with the credit or debit card at the facilities and generating a 
user profile of goods and/or services in response thereto (Fig. 4, step 409; p. 9, lines 30-34; p. 10, 
lines 6-15); prompting a current user with options for goods and/or services during a current 
transaction with the credit or debit card at one of the facilities (Fig. 4, step 41 1; p. 10, lines 1-6); 
comparing the options for goods and/or services selected by the current user with the user profile 
of goods and/or services (Fig. 4, step 413; p. 10, lines 17-22); requiring the current user to 
answer a security-related question if the options for goods and/or services selected by the current 
user do not match the user profile of goods and/or services, or are not within a desired range of 
consistency with the prestored selections of goods and/or services (Fig. 4, step 417; p. 10, line 28 
to p. 11, line 8); and then permitting the current transaction only if the current user correctly 
answers said security-related question (Fig. 4, step 415; p. 11, lines 15-19). 

Independent claim 14 recites a system for automatically authorizing a remote point of 
purchase action at a facility which permits such actions. The system comprises a memory for 
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storing previous selections of goods and/or services made by an authorized user (p. 6, line 20-22; 
Fig. 1, disk drive 222); a user terminal adapted to prompt a user with options for goods and/or 
services during a transaction at the facility (p. 8, lines 29-35; Fig. 3); processor means (p. 6, lines 
15-17; Fig. 1, CPU 212) for comparing options for goods and/or services selected by the user at 
the user terminal during a current transaction with the previous selections of goods and/or 
services stored in the memory (Fig. 4, step 413; p. 10, lines 19-22); control means for requiring 
the user to answer a security-related question when the options for goods and/or services selected 
by the user at the user terminal during the current transaction do not match the previous 
selections of goods and/or services stored in the memory (Fig. 4, step 417; p. 10, line 28 to p. 11, 
line 8), or are not within a desired range of consistency with the previous selections of goods 
and/or services (Fig. 4, step 413; p. 10, lines 22-24), and for thereafter permitting the current 
transaction only when the user correctly answers said security-related question (Fig. 4, step 415; 
p. 11, lines 15-19). 

Independent claim 18 recites a computer program product, residing on a computer usable 
medium and having computer usable program means embodied therein (Fig. 2; p. 6, lines 1-3; p. 
8, lines 5-9). The computer usable program means comprises means for storing selections of 
goods and/or services made by an authorized user during a previous transaction (Fig. 4, step 409; 
p. 9, lines 30-34; p. 10, lines 6-15); means for prompting a user with options for goods and/or 
services during a current transaction at the facility (Fig. 4, step 411; p. 10, lines 1-6); means for 
comparing options for goods and/or services selected by the user with the prestored selections of 
goods and/or services (Fig. 4, step 413; p. 10, lines 17-22); means for requiring the user to 
answer a security-related question if the options for goods and/or services selected by the user do 
not match the prestored selections of goods and/or services, or are not within a desired range of 
consistency with the prestored selections of goods and/or services (Fig. 4, step 417; p. 10, line 28 
to p. 11, line 8); and means for permitting the current transaction only if the user correctly 
answers said security-related question (Fig. 4, step 415; p. 11, lines 15-19). 



GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL 
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I. The Examiner's rejection of Claims 1-4, 6, 8-9, 13-21, 23 and 25 under 35 U.S.C. 
§103(a) as being unpatentable over Findley (U.S. Patent No. 6,108,642) in view of French et al. 
(U.S. Patent No. 6,496,936 - "French") is to be reviewed on Appeal. 

II. The Examiner's rejection of Claims 5, 10 and 22 under 35 U.S.C. §103(a) as being 
unpatentable over Findley in view of French in further view of Penzias (U.S. Patent No. 
5,311 ,594) is to be reviewed on Appeal. 

ARGUMENTS 

I. The Examiner's rejection of Claims 1-4, 6, 8-9, 13-21, 23 and 25 under 35 U.S.C. 
§103 (a) as being unpatentable over Findley in view of French should be reversed because 
Appellant's claimed invention is not obvious in view of the combination of Findley and French. 

A. The combination of Findley and French does not teach, suggest or motivate 
"requiring the user to answer a security-related question if the options for goods and/or 
services selected by the user are inconsistent with the user's prestored selections of goods 
and/or services", as recited by exemplary Claim 1 . 

On Appeal, the Board reversed/remanded the case to the Examiner "to determine whether 
prior art is available that would have fairly suggested to one of ordinary skill in the art to modify 
the Findley method to include the step of requiring the user to answer a security-related question 
if the options for goods and/or services selected by the user are inconsistent with the user's 
prestored selections of goods and/or services." (Decision, p. 7). With reference to the requiring 
step of exemplary Claim 1, the Examiner states on page 6 of the present Office Action that 
Findley does not teach "a system that requires a user to answer, correctly, multiple security- 
related questions if the options for goods and/or services by the user are inconsistent with a 
user's prestored selection of goods and/or services." On page 6 of the present Office Action, the 
Examiner cites French as supplying the missing teaching in Findley. In particular, the Examiner 
cites French at column 6, lines 46-53 as teaching an authentication process which "may invoke 
association check 24 to evaluate whether the request under consideration is associated with the 
other requests or attempts, whether recent, concurrent or otherwise. The purpose of the 
association checks is to filter requests suspected to be fraudulent or part of an attack of some 
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kind." In addition, the Examiner cites the following from French at column 6, line 58 through 
column 7, line 5: 

In a preferred embodiment, authentication process 10 stores information received through 
all requests in the authorization database 152, which stores transaction record 112 
logging all input received from the user. Using this information, association checks based 
upon available data are facilitated. For example, if one attempt at access includes a name 
and an associated social security number, a concurrent or later request with the same 
name but a different social security number may be denied or flagged for further 
authentication , [emphasis supplied by Examiner] 

Conversely, if the later request includes a different name but the previously submitted 
social security number, the request may also be denied or flagged for further 
authentication. Association checks can examine any data provided by the user before or 
during the preprocessing step 26. 

However, the combination of Findley and French fails to teach, suggest or motivate the 
step of requiring the user to answer a security-related question if the options for goods and/or 
services selected by the user are inconsistent with the user's prestored selections of goods and/or 
services, as claimed in the Appellant's application. Taken in combination with Findley, French 
teaches that if a request to access a computer network includes a name and an associated social 
security number , a concurrent or later request with the same name but different social security 
number may be denied or flagged for further authentication (col. 6, line 58 to col. 7 line 5). The 
combination of Findley and French therefore differs from the Appellant's claimed invention in 
that an improper match between a name and social security number is what flags a transaction in 
Findley/French, not inconsistencies between a selection of goods and/or services and a prestored 
selection of goods and/or services, as claimed. Determining whether a name and social security 
number match each other does not teach or suggest comparing a selection of goods and/or 
services with a user's prestored selection of goods and/or services to prompt a security-related 
question. 

Put another way, the method in French denies or flags an attempt to access a network if a 
name and number do not match a known name and number combination. In contrast, Appellant's 
invention reacts to purchasing behavior that deviates from a consistent purchasing pattern. 
Selections of goods and/or services are used to establish a user's identity. This difference can be 
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seen on page 6 the Present Office Action, where the Examiner recites a "prestored selection of 
goods and/or services " as part of the missing teaching in Findley, but later refers to the teachings 
in French as "prestored information ". The prestored "information" of French does not teach, 
suggest or motivate the prestored "goods and/or services" as claimed. French is not prior art that 
would have fairly suggested to one of ordinary skill in the art to modify the Findley method to 
include the step of requiring the user to answer a security-related question if the options for 
goods and/or services selected by the user are inconsistent with the user's prestored selections of 
goods and/or services. 

Therefore, the combination of Findley and French fails to teach, suggest motivate the 
step of requiring the user to answer a security-related question if the options for goods and/or 
services selected by the user are inconsistent with the user's prestored selections of goods and/or 
services, as claimed in the Appellant's application. 

B. The combination of Findley and French does not teach, suggest or motivate 
"comparing the options for goods and/or services selected by the user with the user's 
prestored selections of goods and/or services", as recited by exemplary Claim 1. 

With reference to the comparing step of exemplary Claim 1, the combination of Findley 
and French does not teach or suggest analyzing the actual goods and/or services being selected 
by the user. On page 3 of the present Office Action, the Examiner cites the Abstract of Findley 
as teaching the comparing step as follows: "a logic subsystem that compares the purchase request 
record of the current purchase request with the purchase record of the previous purchase 
request". However, Findley further teaches the comparison is based on criteria such as a 
telephone number (origin) and/or card number for the current purchase request matching a 
telephone number (origin) and/or card number for a previous legitimate purchase request (col. 3, 
lines 53-57; Abstract), a telephone number (origin) matching a number in a "negative file" (col. 
3, lines 39-44), or a "history factor" that takes into account dollar amount or duration since last 
purchase (col. 3, line 66 to col. 4, line 25). Findley does not teach comparing a selection of 
goods and/or services by the user with a prestored selection of goods and/or services by the user. 
Thus, Findley analyzes an entirely different set of criteria for detecting fraud than Appellant. 
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At best, Findley observes the "merchandise category" (column 4, lines 49-61) in which 
the goods may be classified. However, Findley teaches one skilled in the art to guard against 
"repetitive theft from the same merchandise category" (i.e., using repeated purchases from a 
merchandise category to flag a transaction as fraudulent). This teaches away from Appellant's 
invention, which uses inconsistencies in selections of goods and/or services to require a user to 
answer a security-related question. Findley is designed to "limit its exposure to repetitive theft 
from the same merchandise category." Column 4, lines 59-61. In direct contrast, Appellant's 
invention is designed to encourage and protect repetitive purchases of the same merchandise. 
Put another way, Findley' s system and method triggers a security hold on an account if the 
behavior of the user becomes too consistent, where as Appellant's system and method reacts to 
behavior that deviates from a consistent pattern. 

French discloses a network authentication system that provides verification of the 
identity or other attributes of a network user to conduct a transaction (Abstract). However, 
French does not teach or suggest the step of comparing the options for goods and/or services 
selected by the user with the user's prestored selections of goods and/or services, as claimed in 
Appellant's application. French teaches comparing a name and an associated social security 
number used to request access to a computer network to the name and social security number for 
a concurrent or later request. If the name and social security number do not match, the request 
for access may be denied or flagged for further authentication (col. 6, line 58 to col. 7 line 5). 
Comparing a name and social security number to a previously used name and social security 
number pair does not teach, suggest or motivate comparing a selection of goods and/or services 
with a user's prestored selection of goods and/or services . 

Because neither of Findley and French teaches, suggests or motivates comparing options 
for goods and/or services with a prestored selection of goods and/or services, the combination of 
Findley and French fails to teach, suggest or motivate the step of comparing the options for 
goods and/or services selected by the user with the user's prestored selections of goods and/or 
services, as claimed in the Appellant's application. 
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II. The Examiner's rejection of Claims 5, 10 and 22 under 35 U.S.C. §103 (a) as being 
unpatentable over Findley in view of French in further view of Penzias (U.S. Patent No. 
5,311,594) should be reversed because Appellant's claimed invention is not obvious in view of 
the combination of Findley, French and Penzias. 

A. The combination of Findley, French and Penzias does not teach, suggest or 
motivate "storing selections of goods and/or services made by the user while using a 
plurality of credit or debit cards, wherein each of the credit or debit cards has a differenct 
account number", as recited by exemplary Claim 5. 

On Appeal, the Board reversed/remanded the case to the Examiner "to determine whether 
prior art is available that would have fairly suggested to one of ordinary skill in the art to modify 
the Findley method to include the step of requiring the user to answer a security-related question 
if the options for goods and/or services selected by the user are inconsistent with the user's 
prestored selections of goods and/or services." (Decision, p. 7). The Examiner states on page 7 
of the present Office Action that, "The system of Findley in view of French et al, as described 
above does not teach a system that stores selections made with a plurality of credit cards." The 
Examiner cites Penzias as supplying the missing teaching in Findley. In particular, the Examiner 
cites Figure 5 of Penzias as teaching, "a system of providing an individual protection for remote 
purchases; in particularthe system applies to multiple card¥with~different account numbers." 

However, the combination of Findley, French and Penzias fails to teach, suggest or 
motivate the step of storing selections of goods and/or services made by the user while using a 
plurality of credit or debit cards, as claimed in the Appellant's application. Taken in 
combination with Findley and French, Penzias teaches an exemplary structure for storing 
information in a card recognition database 413 (col. 7, lines 63-64). The card recognition 
database 413 is used to determine the issuer of a card from the digits supplied by a user (col. 6, 
lines 46-49). The combination of Findley, French and Penzias therefore differs from the 
Appellant's claimed invention in that the information stored in card recognition database is a list 
of card issuing companies, not selections of goods and/or services made by the user while using 
a plurality of credit or debit cards, as claimed. 
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Therefore, the combination of Findley and French fails to teach, suggest motivate the 
step of storing selections of goods and/or services made by the user while using a plurality of 
credit or debit cards, as claimed in the Appellant's application. 

B. Penzias does not fairly suggest to one of ordinary skill in the art to modify the 
combination of Findley and French to include the step of storing selections of goods 
and/or services made by the user while using a plurality of credit or debit cards, as recited 
by exemplary Claim 5. 

On page 7 of the present Office Action, the Examiner states, "It would have been obvious 
to a person of ordinary skill in the art at the time the invention was made to modify the memory 
subsystem of Findley to receive information sets on previous and current purchases made by a 
user from a plurality of credit cards, as taught by Penzias in order to provide protection and 
security for all of a customer's credit and debit cards." However, Penzias teaches an apparatus 
for use in processing calling card transactions (col. 5, lines 57-59), and in particular a card 
recognition database that is used to determine the issuer of a calling card from the digits supplied 
by a calling party (col. 6, lines 46-49). Penzias is directed toward preventing fraud in purchasing 
long distance telephone calls with calling cards. A user is not prompted with options for 
selecting goods and/or services, as claimed, since only one service is being provided in Penzias 
(i.e., a long distance phone call). Therefore, Penzias does not fairly suggest to one of ordinary 
skill in the art to modify the combination of Findley and French to include the step of storing 
selections of goods and/or services made by the user while using a plurality of credit or debit 
cards, as claimed. 

C. Claim 5. 10 and 22 depend from Claims 1, 9 and 14, respectively. The 
disposition of the rejection of Claims 1, 9 and 14 is further dispositive of the rejection of 
Claims 5, 10 and 22. 

III. Conclusion. 
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It is respectfully urged that the claims are in condition for allowance and favorable action 
is requested. In that the fee of $320 was previously paid for the Appeal Brief submitted on 
August 28, 2003 and the fee of $180 was previously paid for the Appeal Brief submitted on June 
28, 2007, no additional fees are believed to be required. However, if any fees are required to 
further the prosecution of the Application, please charge the additional fees to IBM Corporation 
Deposit Account No. 09-0447. 

Respectfully submitted, 




Brian F. Russell 

Reg. No. 40,796 

DILLON & YUDELL, LLP 

8911 N. Capital of Texas Hwy., Suite 2110 

Austin, Texas 78759 

(512) 343-6116 

ATTORNEY FOR APPELLANT 
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CLAIMS APPENDIX 



1. A method for automatically authorizing a remote point of purchase action at a facility 
which permits such actions, said method comprising the steps of: 

storing selections of goods and/or services made by an authorized user during a previous 
transaction; 

prompting a user with options for selecting goods and/or services during a current 
transaction at the facility; 

comparing the options for goods and/or services selected by the user with the user's 
prestored selections of goods and/or services; 

requiring the user to answer a security-related question if the options for goods and/or 
services selected by the user are inconsistent with the user's prestored selections of goods and/or 
services; and 

thereafter permitting the current transaction only if the user correctly answers said 
security-related question. 

2. The method of claim 1 wherein the step of storing selections comprises generating a user 
profile of selections of goods and/or services made by the user during the last n transactions. 

3. The method of claim 1 wherein the step of storing selections comprises storing selections 
of goods and/or services made by the user at a plurality of facilities. 

4. The method of claim 1 wherein the step of storing selections comprises storing selections 
of goods and/or services made by the user while using a credit or debit card. 

5. The method of claim 1 wherein the step of storing selections comprises storing selections 
of goods and/or services made by the user while using a plurality of credit or debit cards, 
wherein each of the credit or debit cards has a different account number. 
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6. The method of claim 1 wherein the step of requiring the user to answer a security-related 
question is not required if the user's current selections match the prestored selections or are 
within a desired range of consistency with the prestored selections. 

8. The method of claim 1 wherein the step of requiring the user to answer a security-related 
question entails requiring the user to answer a plurality of security-related questions, and wherein 
the step of permitting the current transaction requires the user to answer each of the security- 
related questions correctly. 

9. A method for automatically authorizing a remote point of purchase action with a credit or 
debit card at facilities which permit such actions, said method comprising the steps of: 

storing selections of goods and/or services made by an authorized user during the 
previous n transactions with the credit or debit card at the facilities and generating a user profile 
of goods and/or services in response thereto; 

prompting a current user with options for goods and/or services during a current 
transaction with the credit or debit card at one of the facilities; 

comparing the options for goods and/or services selected by the current user with the user 
profile of goods and/or services; 

requiring the current user to answer a security-related question if the options for goods 
and/or services selected by the current user do not match the user profile of goods and/or 
services, or are not within a desired range of consistency with the prestored selections of goods 
and/or services; and then 

permitting the current transaction only if the current user correctly answers said security- 
related question. 

10. The method of claim 9 wherein the step of storing selections comprises storing selections 
of goods and/or services made by the authorized user while using a plurality of credit or debit 
cards at various ones of the facilities, wherein each of the credit or debit cards has a different 
account number. 
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13. The method of claim 9 wherein the step of requiring the current user to answer a security- 
related question entails requiring the current user to answer a plurality of security-related 
questions, and wherein the step of permitting the current transaction requires the current user to 
answer each of the security-related questions correctly. 

14. A system for automatically authorizing a remote point of purchase action at a facility 
which permits such actions, comprising: 

a memory for storing previous selections of goods and/or services made by an authorized 

user; 

a user terminal adapted to prompt a user with options for goods and/or services during a 
transaction at the facility; 

processor means for comparing options for goods and/or services selected by the user at 
the user terminal during a current transaction with the previous selections of goods and/or 
services stored in the memory; 

control means for requiring the user to answer a security-related question when the 
options for goods and/or services selected by the user at the user terminal during the current 
transaction do not match the previous selections of goods and/or services stored in the memory, 
or are not within a desired range of consistency with the previous selections of goods and/or 
services, and for thereafter permitting the current transaction only when the user correctly 
answers said security-related question. 

15. The system of claim 14 wherein the memory generates a user profile of selections of 
goods and/or services made by the user during the last n transactions. 

16. The system of claim 14 wherein the user terminal is a device for reading a credit or debit 
card. 

17. The system of claim 14 wherein the control means requires the user to correctly answer a 
plurality of security-related questions. 
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18. A computer program product, residing on a computer usable medium and having 
computer usable program means embodied therein, said computer usable program means 
comprising: 

means for storing selections of goods and/or services made by an authorized user during a 
previous transaction; 

means for prompting a user with options for goods and/or services during a current 
transaction at the facility; 

means for comparing options for goods and/or services selected by the user with the 
prestored selections of goods and/or services; 

means for requiring the user to answer a security-related question if the options for goods 
and/or services selected by the user do not match the prestored selections of goods and/or 
services, or are not within a desired range of consistency with the prestored selections of goods 
and/or services; and 

means for permitting the current transaction only if the user correctly answers said 
security-related question. 

19. The computer program product of claim 18 wherein the means for storing selections 
generates a user profile of selections of goods and/or services made by the user during the last n 
transactions. 



20. The computer program product of claim 18 wherein the means for storing selections 
stores selections of goods and/or services made by the user at a plurality of facilities. 

21. The computer program product of claim 18 wherein the means for storing selections 
stores selections of goods and/or services made by the user while using a credit or debit card. 

22. The computer program product of claim 18 wherein the means for storing selections 
stores selections of goods and/or services made by the user while using a plurality of credit or 
debit cards, wherein each of the credit or debit cards has a different account number. 
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23. The computer program product of claim 18 wherein the means for requiring the user to 
answer a security-related question is predicated on the user's current selections of goods and/or 
services being substantially inconsistent with the prestored selections of goods and/or services. 

25. The computer program product of claim 18 wherein the means for requiring the user to 
answer a security-related question entails requiring the user to answer a plurality of security- 
related questions, and wherein the means for permitting the current transaction requires the user 
to answer each of the security-related questions correctly. 
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EVIDENCE APPENDIX 

Other than the Office Actions, responses, briefs and answers already of record, no 
additional evidence has been entered by Appellant or the Examiner in the above-identified 
application which is relevant to this appeal. 
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RELATED PROCEEDINGS APPENDIX 

There axe no related proceedings as described by 37 C.F.R. §41.37(c)(l)(x) know to 
Appellant, Appellant's legal representative, or assignee. 
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